# Software composition analysis for enterprise buyers: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "software composition analysis tool" and as "open source dependency vulnerability scanner", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://it-ai-index.com/developer/software-composition-analysis/enterprise/

**Standing:** Black Duck (tied with Sonatype Lifecycle) leads with 19% of first choices; verdict contested. 42 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Black Duck | 19% | 6% | 47 |
| 2 | Sonatype Lifecycle | 19% | 8% | 40 |
| 3 | Aikido Security | 14% | 0% | 12 |
| 4 | OWASP Dependency-Track | 14% | 0% | 10 |
| 5 | Snyk Open Source | 10% | 19% | 47 |
| 6 | Mend.io | 10% | 17% | 41 |
| 7 | Trivy | 7% | 0% | 15 |
| 8 | OWASP Dependency-Check | 5% | 61% | 18 |
| 9 | JFrog Xray | 2% | 16% | 19 |
| 10 | Endor Labs | 0% | 5% | 22 |
| 11 | Checkmarx SCA | 0% | 7% | 15 |
| 12 | Veracode | 0% | 8% | 13 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Mend.io, Sonatype Lifecycle; alternatives Black Duck, Checkmarx SCA, Snyk Open Source
- GPT-5.4 mini: Sonatype Lifecycle; alternatives Black Duck, Palo Alto Networks Cortex Cloud SCA, Snyk Open Source, Veracode
- Gemini 3.5 Flash: Black Duck; alternatives FOSSA, GitHub Advanced Security, GitLab Dependency Scanning, Snyk Open Source
- Perplexity Sonar: Sonatype Lifecycle; alternatives Black Duck, Checkmarx SCA, Mend.io, Snyk Open Source
- Grok 4.1 Fast: Black Duck, Sonatype Lifecycle; alternatives Snyk Open Source
- Mistral Small: Snyk Open Source, Sonatype Lifecycle; alternatives Black Duck, Mend.io
- DeepSeek V4 Flash: Black Duck, Snyk Open Source; alternatives Endor Labs, Mend.io, Sonatype Lifecycle
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Mend.io; alternatives Black Duck, Snyk Open Source, Sonatype Lifecycle
- Kimi K2: Black Duck; alternatives Snyk Open Source, Sonatype Lifecycle
- GLM 4.7 FlashX: Black Duck; alternatives Endor Labs, Mend.io, Snyk Open Source, Sonatype Lifecycle
- MiniMax M2.5: Black Duck; alternatives Mend.io, Snyk Open Source

## Sources the answers cite

66 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- endorlabs.com: 42 answers, 62 citations
- guideflow.com: 37 answers, 37 citations
- cycode.com: 31 answers, 36 citations
- safeguard.sh: 28 answers, 53 citations
- mend.io: 23 answers, 29 citations
- aikido.dev: 22 answers, 35 citations
- blackduck.com: 21 answers, 35 citations
- ox.security: 21 answers, 23 citations

Pages named in the most answers:

- https://endorlabs.com/learn/best-sca-tools-05b7a (39 answers)
- https://guideflow.com/blog/software-composition-analysis-tools (29 answers)
- https://cycode.com/blog/top-enterprise-sca-tools (26 answers)
- https://ox.security/blog/software-composition-analysis-and-sca-tools (21 answers)
- https://dupple.com/learn/best-software-composition-analysis-tools (19 answers)
- https://endorlabs.com/learn/best-sca-tools (19 answers)
- https://expertinsights.com/application-security/the-top-software-composition-analysis-tools (19 answers)
- https://toolradar.com/blog/best-software-composition-analysis-tools (18 answers)
- https://sonatype.com/compare/best-sca-tools (17 answers)
- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf (13 answers)

## Warned against

- OWASP Dependency-Check: 11 of 18 labels negative. "Avoid as your primary enterprise SCA; use only as a supplementary check for legacy Java-only codebases." (DeepSeek V4 Flash, negative prompt)
- Snyk Open Source: 9 of 47 labels negative. "Avoid tools like Snyk, Socket, or Semgrep if your primary goal is cost prediction" (Qwen 3.7 Flash, budget prompt)
- Mend.io: 7 of 41 labels negative. "Same scaling problem; thousands of users = unpredictable ballooning costs" (Kimi K2, budget prompt)
- FOSSA: 3 of 16 labels negative. "What to Avoid for Your Use Case ... FOSSA | Per-project or per-developer hybrid" (Kimi K2, budget prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.